Create separate S3 bucket for user uploaded files

[cdriehuys]

User uploaded files and static files are very distinct in terms of caching policies and the consequences of deleting files. As such, they should be stored in separate S3 buckets.

[cdriehuys]

There are a whole host of improvements we can make if we separate static files from user-uploaded media files.

CORS

Currently we have a wide open CORS policy applied to the whole bucket. We could first of all remove CORS headers from the media files and restrict the static file headers to only allow usage on our API domain.

Caching

Static files can be cached forever (as long as we make sure they are uploaded with a hash) versus media files which should not be cached at all.

Deletion Protection

The media files bucket should have deletion protection enabled whereas the static files bucket does not need it.